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1. (Currently amended) A real-time virus tracking and display system for use with a 

disuibuted computer network, the system comprising: 

a plurality of client users having potentially infected client gnd-user computers^sajdend^ 
..^r nnmr^uters h<^ino distributed over said disiribnted compuIQr network; 

at least one anti-virus scanning server accessible via the distributed computer network, 
.^i ^ .running server including an ^ .r^n.^nr,,. .r...W,r.a nrogram. whereby the client users contact 
the scanning server to facilitate virus scanning of the client gT^d-user computers b y . dQwnloadinfi 
said ami-virus scann inp program: 

a scan log which is sent back over said distrihuted computer network from each client 
user detailing certain results of the virus scanning on each client endbHSSr computer IsiMi 
antivirus scanning program : 

a virus-tracking server for receiving the scan log information tirom said client eqa-W§er 
computers in real-time; 

a database server associated with the vims-tracking server for processing the scan log 
information into viru^-tracking information; and 

at least one virus tracking display mode accessible by a tracking user from the virus 
tracking server, the display mode providing real-time updates of said virus tracking information 
pertaining to the scan logs. 



2. (Previously presented) The system according to Claim 1 , wherein the tracking 

user can configure the display modes to show the virus-tracking information in association widi 
user-selected geographic maps of where the viruses are occurring. 
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3. (Previously presented) The system according to Claim 2. wherein the display 
modes includes a plurality of web pages with user selectable menus to configure the virus 
tracking display mode on the pages. 

4. (Previously presented) The system according to Claim 1, wherein the scan log 
information contains no information relating to the direct identification of the client user, 

5. (Previously presented) The system according lo Claim 4, wherein the scan log 
information includes the name of the virus, the frequency of its occurrence, and the geographic 
location of the infected computer, 

6. (Previously presented) The system according to Claim 1, wherein a servlet 
program on the virus-tracking server is used ro receive the scan log information from the at least 
one anti-virus scanning server. 

7. (Previously presented) The system according to Claim I , wherein a polling 
program is used lo regularly retrieve the virus tracking infonnation from the database server and 
store ii in a data object. 

8. (Previously presented) The system of Claim 7, wherein a conmion gateway 
interface (CGI) program is used to retrieve the data object for display by the tracking user. 

9. (Previously presented) The sysiem of Claim 1 , wherein a Java applet running on a 
tracking user browser is used to display a real-time virus trace map. 
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10. (Previously presented) 
tracking user. 



The system of Claim 1. wherein the client user is also the 



U (Previously presented) The system of Claim i. wherein the distributed computer 

netv^ork includes the Internet, wherein said scan log from each scanned client computer is sent 
back over the Internet to be received by said vims tracking server, and wherein said virus 
tracking display mode is accessible over the Internet by said tracking user. 
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1 2. (Currently amended) A method to provide real-time vims tracking and display 
for use with a distributed computer network, the method comprising: 

providing an anti-virus scanning program on ai least one anti-virus scanning server 
accessible via the distributed computer network; 

invoking the anti-virus scanning program from a plurality of client users having 
potentially infected client end-user computers by downloading said antivirus scanning program, 
said end-user computers being distributed over said distributed computer network : 

generating a scan log from each scanned client end-user computer and sending the scan 
log back from each client user over said disiributed computer network, the scan log detailing 
certain results of the scanning program on each client end-user computer; 

receiving the scan log information from said client end-user computers in real-time via a 
virus tracking server associated with the distributed computer network; 

processing the scan log information into virus tracking information and storing it on a 
database server associated with the virus-tracking server; and 

retrieving the virus tracking information and displaying a real-lime trace on a tracking 
user device. 

13. (Previously presented) The method according to Claim 12, which further includes 
configuring display modes by the tracking user to show the virus-tracking information in 
association with user-selected geographic maps of where the viruses are occurring. 

14. (Previously presented) The method according to Claim 13, which ftirther includes 
displaying the display modes via a plurality of web pages with user selectable menus to 
configure the virus-tracking information on the pages. 
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15. (Original) The method according to Claim 12, wherein the scan log contains no 
infonnation relating to the direct identificalion of the client user. 



16 (Original) The method according to Claim 1 5. wherein the scan log includes the 
name of the virus, the frequency of its occurrence, and the geographic location of the it^ected 
computer. 

17. (Previously presented) The method according to Claim 12. which ftirther includes 

providing a servlet program on the virus-tracking server to receive the scan log from the at least 
one anti-virus scanning server. 



18. (Previously presented) TTie method according to Claim 12, which fixrther includes 

providing a polling program to regularly retrieve virus tracking infonnation from the database 
server and store it in a data object. 



19. (Original) The method of Claim 18, which further includes providing a common 
gateway interface (CGI) program to retrieve the data object for display by the tracking user. 



20. (Previously presented) The method of Claim 12. which further includes running a 

Java applet on the browser of the tracking user device to display a real-time virus trace map. 



21. (Previously presented) The method of Claim 12, wherein the cliem user is also 

the tracking user. 
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22. (Previously presented) The method of Claim 12, wherein the distributed 

computer network includes the Imernel, wherein said scan log from each scanned client 
computer is sent back over the Internet to be received by said virus tracking server, and wheiem 
said real-time trace displayed on said tracking user device is made available over the Internet. 

Please add the following new claims: 



23 . (New) The system according to claim 1 wherein said virus tracking information 

identifies concentrations of a compuier vims at said client end-user computer locations. 



24. (New) The system according to claim 1 wherein said scan log information is 

processed by aggregating said scan logs from each client end-user computer and then 
synthesizing said virus tracking information. 



25. (New) The method according to claim 12 wherein said virus ti-acking information 

identifies concentmtions of a compuier virus at said client end-user compuier locations. 



26. (New) The method according to claim 12 wherein processing said scan log 

information includes 

aggregating said scan logs from each client end-user compuier, and 
synthesizing said virus tracking infoimation from said aggregated scan logs. 
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